{"id":1222,"date":"2026-02-13T18:30:53","date_gmt":"2026-02-13T17:30:53","guid":{"rendered":"https:\/\/regulated-devsecops.com\/uncategorized\/dora-article-28-red-flags-common-third-party-risk-failures-in-ci-cd-2\/"},"modified":"2026-03-26T00:09:28","modified_gmt":"2026-03-25T23:09:28","slug":"dora-article-28-red-flags-common-third-party-risk-failures-in-ci-cd","status":"publish","type":"post","link":"https:\/\/regulated-devsecops.com\/fr\/ci-cd-governance\/dora-article-28-red-flags-common-third-party-risk-failures-in-ci-cd\/","title":{"rendered":"DORA Article 28 : Signaux d&rsquo;alerte \u2014 D\u00e9faillances courantes des risques tiers dans les pipelines CI\/CD"},"content":{"rendered":"\n<p>Les manquements au titre de DORA Article 28 proviennent rarement de politiques absentes.<\/p>\n\n\n\n<p>Ils proviennent de <strong>faiblesses cach\u00e9es dans les pipelines CI\/CD d\u00e9pendant de tiers<\/strong> qui ne se r\u00e9v\u00e8lent que lors d&rsquo;audits ou d&rsquo;incidents.<\/p>\n\n\n\n<p>Les auditeurs recherchent des <strong>signaux d&rsquo;alerte<\/strong> \u2014 des indices que le risque ICT li\u00e9 aux tiers est non g\u00e9r\u00e9, non appliqu\u00e9 ou non \u00e9tay\u00e9 par des preuves.<\/p>\n\n\n\n<p>Les plateformes CI\/CD sont une source fr\u00e9quente de telles constatations car elles combinent <strong>services externes, ex\u00e9cution privil\u00e9gi\u00e9e et automatisation<\/strong>.<\/p>\n\n\n\n<p>Cet article met en lumi\u00e8re les <strong>signaux d&rsquo;alerte les plus courants li\u00e9s \u00e0 l&rsquo;Article 28 concernant les pipelines CI\/CD<\/strong>, leur importance et la mani\u00e8re dont les auditeurs les interpr\u00e8tent.<\/p>\n\n\n\n<!-- GeneratePress Inline SVG \u2013 Regulated DevSecOps -->\n<figure class=\"gp-rds-diagram\">\n<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\"\n     viewBox=\"0 0 1200 560\"\n     role=\"img\"\n     aria-labelledby=\"title desc\"\n     data-theme=\"light\">\n  <title id=\"title\">CI\/CD Red Flags \u2014 DORA Article 28 (Third-Party Risk)<\/title>\n  <desc id=\"desc\">\n    Enterprise CI\/CD diagram highlighting common DORA Article 28 third-party risk red flags:\n    missing exit plan, shared runners, lack of sub-processor visibility, missing audit rights,\n    and missing evidence retention.\n  <\/desc>\n\n  <style>\n    :root{\n      --bg:transparent;\n      --text:#0f172a;\n      --muted:#475569;\n      --stroke:#cbd5e1;\n      --card:#ffffff;\n\n      --accent:#2563eb;\n      --accentSoft:#dbeafe;\n\n      --warn:#b91c1c;\n      --warnSoft:#fee2e2;\n\n      --ok:#059669;\n      --okSoft:#d1fae5;\n\n      --band:#0ea5e9;\n      --bandSoft:#e0f2fe;\n    }\n    svg[data-theme=\"dark\"]{\n      --text:#e5e7eb;\n      --muted:#9ca3af;\n      --stroke:#374151;\n      --card:#0b1220;\n\n      --accent:#60a5fa;\n      --accentSoft:#0b2a55;\n\n      --warn:#f87171;\n      --warnSoft:#3a0b10;\n\n      --ok:#34d399;\n      --okSoft:#063a2c;\n\n      --band:#38bdf8;\n      --bandSoft:#083047;\n    }\n\n    .txt{font-family:ui-sans-serif,system-ui,-apple-system,Segoe UI,Roboto,Arial;}\n    .title{font-weight:900;font-size:22px;fill:var(--text);}\n    .sub{font-weight:600;font-size:14px;fill:var(--muted);}\n\n    .label{font-weight:900;font-size:12px;fill:var(--text);letter-spacing:.06em;}\n    .h{font-weight:900;font-size:14px;fill:var(--text);}\n    .small{font-weight:700;font-size:12px;fill:var(--muted);}\n\n    .card{fill:var(--card);stroke:var(--stroke);stroke-width:1.5;rx:14;}\n    .chip{fill:transparent;stroke:var(--stroke);stroke-width:1.5;rx:7;}\n    .chipText{font-weight:900;font-size:12px;fill:var(--text);}\n\n    .flow{fill:none;stroke:var(--stroke);stroke-width:2.5;stroke-linecap:round;stroke-linejoin:round;}\n    .arrow{marker-end:url(#arrow);}\n\n    .band{fill:transparent;stroke:var(--stroke);stroke-width:1.5;rx:14;stroke-dasharray:6 6;}\n    .bandTitle{font-weight:900;font-size:12px;fill:var(--muted);letter-spacing:.06em;}\n    .bandChip{fill:var(--bandSoft);stroke:var(--band);stroke-width:1.5;rx:7;}\n    .bandText{font-weight:900;font-size:12px;fill:var(--text);}\n\n    .rf .chip{stroke:var(--warn);fill:var(--warnSoft);}\n    .rftext{font-weight:900;font-size:12px;fill:var(--text);}\n\n    .ok .chip{stroke:var(--ok);fill:var(--okSoft);}\n  <\/style>\n\n  <defs>\n    <marker id=\"arrow\" viewBox=\"0 0 10 10\" refX=\"9.2\" refY=\"5\" markerWidth=\"7\" markerHeight=\"7\" orient=\"auto\">\n      <path d=\"M0 0 L10 5 L0 10 Z\" fill=\"var(--stroke)\"\/>\n    <\/marker>\n  <\/defs>\n\n  <!-- Header -->\n  <text class=\"txt title\" x=\"40\" y=\"48\">CI\/CD Red Flags \u2014 DORA Article 28<\/text>\n  <text class=\"txt sub\" x=\"40\" y=\"74\">Third-party risk failures auditors frequently flag in Git, CI\/CD SaaS, runners, registries, and cloud runtime.<\/text>\n\n  <!-- Cross-cutting band -->\n  <g transform=\"translate(40,92)\">\n    <rect class=\"band\" x=\"0\" y=\"0\" width=\"1120\" height=\"62\"\/>\n    <text class=\"txt bandTitle\" x=\"18\" y=\"36\">CROSS-CUTTING (ARTICLE 28)<\/text>\n\n    <g transform=\"translate(330,16)\">\n      <rect class=\"bandChip\" x=\"0\" y=\"0\" width=\"180\" height=\"30\"\/>\n      <text class=\"txt bandText\" x=\"90\" y=\"20\" text-anchor=\"middle\">Supplier governance<\/text>\n    <\/g>\n    <g transform=\"translate(520,16)\">\n      <rect class=\"bandChip\" x=\"0\" y=\"0\" width=\"160\" height=\"30\"\/>\n      <text class=\"txt bandText\" x=\"80\" y=\"20\" text-anchor=\"middle\">Audit rights<\/text>\n    <\/g>\n    <g transform=\"translate(690,16)\">\n      <rect class=\"bandChip\" x=\"0\" y=\"0\" width=\"150\" height=\"30\"\/>\n      <text class=\"txt bandText\" x=\"75\" y=\"20\" text-anchor=\"middle\">Exit strategy<\/text>\n    <\/g>\n    <g transform=\"translate(850,16)\">\n      <rect class=\"bandChip\" x=\"0\" y=\"0\" width=\"220\" height=\"30\"\/>\n      <text class=\"txt bandText\" x=\"110\" y=\"20\" text-anchor=\"middle\">Evidence retention<\/text>\n    <\/g>\n  <\/g>\n\n  <!-- Pipeline row cards -->\n  <g transform=\"translate(40,175)\">\n    <!-- Git -->\n    <g transform=\"translate(0,0)\">\n      <rect class=\"card\" width=\"200\" height=\"130\"\/>\n      <text class=\"txt h\" x=\"18\" y=\"32\">Git Hosting<\/text>\n      <text class=\"txt small\" x=\"18\" y=\"54\">GitHub \/ GitLab SaaS<\/text>\n      <g class=\"rf\" transform=\"translate(18,74)\">\n        <rect class=\"chip\" width=\"164\" height=\"30\"\/>\n        <text class=\"txt rftext\" x=\"82\" y=\"20\" text-anchor=\"middle\">No audit rights<\/text>\n      <\/g>\n    <\/g>\n\n    <!-- CI\/CD SaaS -->\n    <g transform=\"translate(220,0)\">\n      <rect class=\"card\" width=\"200\" height=\"130\"\/>\n      <text class=\"txt h\" x=\"18\" y=\"32\">CI\/CD SaaS<\/text>\n      <text class=\"txt small\" x=\"18\" y=\"54\">Orchestrator<\/text>\n      <g class=\"rf\" transform=\"translate(18,74)\">\n        <rect class=\"chip\" width=\"164\" height=\"30\"\/>\n        <text class=\"txt rftext\" x=\"82\" y=\"20\" text-anchor=\"middle\">No exit plan<\/text>\n      <\/g>\n    <\/g>\n\n    <!-- Runners -->\n    <g transform=\"translate(440,0)\">\n      <rect class=\"card\" width=\"200\" height=\"130\"\/>\n      <text class=\"txt h\" x=\"18\" y=\"32\">CI Runners<\/text>\n      <text class=\"txt small\" x=\"18\" y=\"54\">Cloud execution<\/text>\n      <g class=\"rf\" transform=\"translate(18,74)\">\n        <rect class=\"chip\" width=\"164\" height=\"30\"\/>\n        <text class=\"txt rftext\" x=\"82\" y=\"20\" text-anchor=\"middle\">Shared runners<\/text>\n      <\/g>\n    <\/g>\n\n    <!-- Registries -->\n    <g transform=\"translate(660,0)\">\n      <rect class=\"card\" width=\"200\" height=\"130\"\/>\n      <text class=\"txt h\" x=\"18\" y=\"32\">Registries<\/text>\n      <text class=\"txt small\" x=\"18\" y=\"54\">Artifacts + images<\/text>\n      <g class=\"rf\" transform=\"translate(18,74)\">\n        <rect class=\"chip\" width=\"164\" height=\"30\"\/>\n        <text class=\"txt rftext\" x=\"82\" y=\"20\" text-anchor=\"middle\">No retention<\/text>\n      <\/g>\n    <\/g>\n\n    <!-- Cloud runtime -->\n    <g transform=\"translate(880,0)\">\n      <rect class=\"card\" width=\"220\" height=\"130\"\/>\n      <text class=\"txt h\" x=\"18\" y=\"32\">Cloud Runtime<\/text>\n      <text class=\"txt small\" x=\"18\" y=\"54\">Prod services<\/text>\n      <g class=\"rf\" transform=\"translate(18,74)\">\n        <rect class=\"chip\" width=\"184\" height=\"30\"\/>\n        <text class=\"txt rftext\" x=\"92\" y=\"20\" text-anchor=\"middle\">No sub-processor view<\/text>\n      <\/g>\n    <\/g>\n  <\/g>\n\n  <!-- Flow arrows between pipeline stages -->\n  <path class=\"flow arrow\" d=\"M 240 240 L 260 240\"\/>\n  <path class=\"flow arrow\" d=\"M 460 240 L 480 240\"\/>\n  <path class=\"flow arrow\" d=\"M 680 240 L 700 240\"\/>\n  <path class=\"flow arrow\" d=\"M 900 240 L 920 240\"\/>\n\n  <!-- Lower remediation hints -->\n  <g transform=\"translate(40,340)\">\n    <rect class=\"card\" width=\"1100\" height=\"170\"\/>\n    <text class=\"txt label\" x=\"18\" y=\"28\">ENGINEER REMEDIATION HINTS<\/text>\n\n    <g class=\"ok\" transform=\"translate(18,52)\">\n      <rect class=\"chip\" width=\"260\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"130\" y=\"20\" text-anchor=\"middle\">Tested exit strategy (CI\/CD)<\/text>\n    <\/g>\n    <g class=\"ok\" transform=\"translate(290,52)\">\n      <rect class=\"chip\" width=\"250\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"125\" y=\"20\" text-anchor=\"middle\">Dedicated \/ isolated runners<\/text>\n    <\/g>\n    <g class=\"ok\" transform=\"translate(550,52)\">\n      <rect class=\"chip\" width=\"270\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"135\" y=\"20\" text-anchor=\"middle\">Supplier + sub-processor map<\/text>\n    <\/g>\n    <g class=\"ok\" transform=\"translate(830,52)\">\n      <rect class=\"chip\" width=\"260\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"130\" y=\"20\" text-anchor=\"middle\">Centralized logs + retention<\/text>\n    <\/g>\n\n    <text class=\"txt small\" x=\"18\" y=\"110\">\n      Auditor rule: if controls cannot produce time-bound evidence on demand, they are treated as ineffective under Article 28.\n    <\/text>\n    <text class=\"txt small\" x=\"18\" y=\"136\">\n      Focus areas: CI\/CD platform scope, contractual auditability, runner isolation, sub-processor governance, and evidence retention.\n    <\/text>\n  <\/g>\n<\/svg>\n  <figcaption class=\"gp-rds-caption\">\n    Enterprise CI\/CD diagram highlighting common DORA Article 28 third-party risk red flags:\n    missing exit plan, shared runners, lack of sub-processor visibility, missing audit rights,\n    and missing evidence retention.\n<\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Pourquoi les signaux d&rsquo;alerte CI\/CD sont importants au titre de l&rsquo;Article 28<\/strong><\/h2>\n\n\n\n<p>Sous DORA, le risque li\u00e9 aux tiers n&rsquo;est pas th\u00e9orique.<\/p>\n\n\n\n<p>Les auditeurs \u00e9valuent si une d\u00e9faillance chez un fournisseur tiers pourrait :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>perturber des services critiques,<\/li>\n\n\n\n<li>compromettre l&rsquo;int\u00e9grit\u00e9 des syst\u00e8mes,<\/li>\n\n\n\n<li>ou emp\u00eacher le respect des obligations r\u00e9glementaires.<\/li>\n<\/ul>\n\n\n\n<p>Les pipelines CI\/CD sont souvent des <strong>points de d\u00e9faillance uniques<\/strong> dans la livraison logicielle.<\/p>\n\n\n\n<p>Les signaux d&rsquo;alerte dans ce domaine sont donc trait\u00e9s comme des <strong>constatations de haute gravit\u00e9<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Signal d&rsquo;alerte n\u00b01 \u2014 Absence de plan de sortie des plateformes CI\/CD SaaS<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Ce que les auditeurs observent<\/strong><\/h3>\n\n\n\n<p>Les organisations d\u00e9pendent fortement des plateformes CI\/CD SaaS mais ne peuvent pas d\u00e9montrer :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>comment migrer les pipelines,<\/li>\n\n\n\n<li>comment r\u00e9cup\u00e9rer les logs et artefacts historiques,<\/li>\n\n\n\n<li>comment maintenir la continuit\u00e9 si le fournisseur devient indisponible.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Pourquoi c&rsquo;est un signal d&rsquo;alerte<\/strong><\/h3>\n\n\n\n<p>DORA Article 28 exige explicitement des <strong>strat\u00e9gies de sortie<\/strong> pour les fournisseurs ICT tiers critiques.<\/p>\n\n\n\n<p>Un plan de sortie qui n&rsquo;existe que sur papier \u2014 sans faisabilit\u00e9 technique \u2014 est consid\u00e9r\u00e9 comme insuffisant.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Conclusion typique de l&rsquo;auditeur<\/strong><\/h3>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u201cThe organization is operationally locked-in to a critical ICT provider.\u201d<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Signal d&rsquo;alerte n\u00b02 \u2014 Runners CI partag\u00e9s entre locataires<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Ce que les auditeurs observent<\/strong><\/h3>\n\n\n\n<p>Les t\u00e2ches CI s&rsquo;ex\u00e9cutent sur :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>des runners partag\u00e9s,<\/li>\n\n\n\n<li>une infrastructure mutualis\u00e9e,<\/li>\n\n\n\n<li>avec une visibilit\u00e9 limit\u00e9e sur les contr\u00f4les d&rsquo;isolation.<\/li>\n<\/ul>\n\n\n\n<p>Souvent, les organisations ne peuvent pas expliquer :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>comment l&rsquo;isolation des runners est appliqu\u00e9e,<\/li>\n\n\n\n<li>qui contr\u00f4le l&rsquo;environnement d&rsquo;ex\u00e9cution,<\/li>\n\n\n\n<li>si la fuite de donn\u00e9es est techniquement emp\u00each\u00e9e.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Pourquoi c&rsquo;est un signal d&rsquo;alerte<\/strong><\/h3>\n\n\n\n<p>Les runners partag\u00e9s augmentent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>le risque de confidentialit\u00e9,<\/li>\n\n\n\n<li>le risque d&rsquo;int\u00e9grit\u00e9,<\/li>\n\n\n\n<li>l&rsquo;exposition aux mouvements lat\u00e9raux.<\/li>\n<\/ul>\n\n\n\n<p>Au titre de l&rsquo;Article 28, cela soul\u00e8ve des questions sur la <strong>classification des risques fournisseurs et l&rsquo;efficacit\u00e9 des contr\u00f4les<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Signal d&rsquo;alerte n\u00b03 \u2014 Aucune visibilit\u00e9 sur les sous-traitants<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Ce que les auditeurs observent<\/strong><\/h3>\n\n\n\n<p>Les organisations :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>contractent avec un fournisseur CI\/CD ou Git principal,<\/li>\n\n\n\n<li>mais manquent de visibilit\u00e9 sur les <strong>sous-traitants<\/strong> (fournisseurs cloud, runners, registres, services de surveillance).<\/li>\n<\/ul>\n\n\n\n<p>Les inventaires fournisseurs s&rsquo;arr\u00eatent souvent au premier niveau.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Pourquoi c&rsquo;est un signal d&rsquo;alerte<\/strong><\/h3>\n\n\n\n<p>DORA Article 28 exige une surveillance non seulement des fournisseurs directs, mais aussi des <strong>cha\u00eenes de sous-traitance critiques<\/strong>.<\/p>\n\n\n\n<p>L&rsquo;absence de visibilit\u00e9 sur les sous-traitants indique :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>une \u00e9valuation des risques incompl\u00e8te,<\/li>\n\n\n\n<li>une gouvernance fournisseurs insuffisante.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Signal d&rsquo;alerte n\u00b04 \u2014 Absence de droits d&rsquo;audit dans les contrats CI\/CD<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Ce que les auditeurs observent<\/strong><\/h3>\n\n\n\n<p>Les contrats avec les fournisseurs CI\/CD ou Git SaaS :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ne comportent pas de clauses d&rsquo;audit ou d&rsquo;inspection,<\/li>\n\n\n\n<li>ou contiennent des droits d&rsquo;audit pratiquement inutilisables.<\/li>\n<\/ul>\n\n\n\n<p>Dans certains cas, les \u00e9quipes d&rsquo;ing\u00e9nierie ignorent les limitations contractuelles.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Pourquoi c&rsquo;est un signal d&rsquo;alerte<\/strong><\/h3>\n\n\n\n<p>Sans droits d&rsquo;audit :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>les contr\u00f4les ne peuvent pas \u00eatre v\u00e9rifi\u00e9s ind\u00e9pendamment,<\/li>\n\n\n\n<li>la d\u00e9pendance aux assurances du fournisseur devient in\u00e9vitable.<\/li>\n<\/ul>\n\n\n\n<p>Les auditeurs traitent cela comme une <strong>lacune structurelle de conformit\u00e9<\/strong>, et non comme un oubli proc\u00e9dural.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Signal d&rsquo;alerte n\u00b05 \u2014 Absence de conservation des preuves pour les activit\u00e9s CI\/CD<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Ce que les auditeurs observent<\/strong><\/h3>\n\n\n\n<p>Les plateformes CI\/CD g\u00e9n\u00e8rent des logs, des approbations et des traces d&rsquo;ex\u00e9cution, mais :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>les logs sont conserv\u00e9s pendant de courtes p\u00e9riodes,<\/li>\n\n\n\n<li>les preuves sont \u00e9cras\u00e9es ou inaccessibles,<\/li>\n\n\n\n<li>les politiques de conservation sont ind\u00e9finies.<\/li>\n<\/ul>\n\n\n\n<p>Les preuves sont souvent collect\u00e9es <strong>apr\u00e8s notification d&rsquo;audit<\/strong>, et non de mani\u00e8re continue.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Pourquoi c&rsquo;est un signal d&rsquo;alerte<\/strong><\/h3>\n\n\n\n<p>DORA Article 28 est fond\u00e9 sur les preuves.<\/p>\n\n\n\n<p>Si les preuves ne peuvent pas \u00eatre produites <strong>\u00e0 la demande<\/strong>, les contr\u00f4les sont consid\u00e9r\u00e9s comme inefficaces.<\/p>\n\n\n\n<p>Ce signal d&rsquo;alerte entra\u00eene fr\u00e9quemment :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>des observations d&rsquo;audit,<\/li>\n\n\n\n<li>des plans de rem\u00e9diation,<\/li>\n\n\n\n<li>des revues de suivi.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Signaux d&rsquo;alerte CI\/CD suppl\u00e9mentaires fr\u00e9quemment identifi\u00e9s par les auditeurs<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Utilisation non restreinte des plugins de la marketplace CI\/CD<\/li>\n\n\n\n<li>Absence de portes d&rsquo;approbation pour les modifications de pipeline<\/li>\n\n\n\n<li>Secrets expos\u00e9s \u00e0 des contextes d&rsquo;ex\u00e9cution tiers<\/li>\n\n\n\n<li>Absence de surveillance de la disponibilit\u00e9 de la plateforme CI\/CD<\/li>\n\n\n\n<li>Application incoh\u00e9rente des contr\u00f4les entre les pipelines<\/li>\n<\/ul>\n\n\n\n<p>Chacun de ces points affaiblit la confiance dans la gestion des risques li\u00e9s aux tiers.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Comment les auditeurs utilisent les signaux d&rsquo;alerte<\/strong><\/h2>\n\n\n\n<p>Les signaux d&rsquo;alerte sont rarement \u00e9valu\u00e9s isol\u00e9ment.<\/p>\n\n\n\n<p>Les auditeurs recherchent des <strong>sch\u00e9mas r\u00e9currents<\/strong> :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>plusieurs signaux d&rsquo;alerte autour du m\u00eame fournisseur,<\/li>\n\n\n\n<li>des \u00e9carts entre les contrats et l&rsquo;application technique,<\/li>\n\n\n\n<li>des liens manquants entre les contr\u00f4les et les preuves.<\/li>\n<\/ul>\n\n\n\n<p>Lorsque des sch\u00e9mas \u00e9mergent, les auditeurs peuvent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>augmenter la criticit\u00e9 du fournisseur,<\/li>\n\n\n\n<li>\u00e9largir le p\u00e9rim\u00e8tre d&rsquo;audit,<\/li>\n\n\n\n<li>exiger une rem\u00e9diation dans des d\u00e9lais stricts.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Comment traiter ces signaux d&rsquo;alerte de mani\u00e8re proactive<\/strong><\/h2>\n\n\n\n<p>Les organisations qui obtiennent de bons r\u00e9sultats au titre de l&rsquo;Article 28 :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>int\u00e8grent explicitement les plateformes CI\/CD comme tiers ICT,<\/li>\n\n\n\n<li>appliquent les contr\u00f4les via la configuration des pipelines,<\/li>\n\n\n\n<li>alignent les contrats avec la r\u00e9alit\u00e9 technique,<\/li>\n\n\n\n<li>g\u00e9n\u00e8rent des preuves continues et immuables.<\/li>\n<\/ul>\n\n\n\n<p>Surtout, elles traitent la s\u00e9curit\u00e9 CI\/CD comme <strong>faisant partie de la gouvernance des risques tiers<\/strong>, et non simplement comme un outillage DevOps.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Point cl\u00e9<\/strong><\/h2>\n\n\n\n<p>Les pipelines CI\/CD figurent parmi les <strong>sources les plus courantes de constatations d&rsquo;audit au titre de l&rsquo;Article 28<\/strong>.<\/p>\n\n\n\n<p>Les signaux d&rsquo;alerte tels que :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>l&rsquo;absence de strat\u00e9gies de sortie,<\/li>\n\n\n\n<li>un isolement insuffisant,<\/li>\n\n\n\n<li>l&rsquo;absence de droits d&rsquo;audit,<\/li>\n\n\n\n<li>une conservation des preuves insuffisante<\/li>\n<\/ul>\n\n\n\n<p>signalent un risque tiers non g\u00e9r\u00e9.<\/p>\n\n\n\n<p>Traiter ces probl\u00e8mes en amont transforme les pipelines CI\/CD de passifs d&rsquo;audit en <strong>atouts de conformit\u00e9 solides<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Contenu associ\u00e9<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><a href=\"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/third-party-risk-in-ci-cd-pipelines-under-dora-article-28\/\" data-type=\"post\" data-id=\"368\">Third-Party Risk in CI\/CD Pipelines under DORA Article 28<\/a><\/strong><\/li>\n\n\n\n<li><strong><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/dora-article-28-evidence-pack-what-to-show-auditors\/\" data-type=\"post\" data-id=\"347\">DORA Article 28 Evidence Pack \u2014 What to Show Auditors<\/a><\/strong><\/li>\n\n\n\n<li><strong><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/dora-article-28-architecture-third-party-risk-controls-across-ci-cd-pipelines\/\" data-type=\"post\" data-id=\"364\">DORA Article 28 Architecture: Third-Party Risk Controls Across CI\/CD Pipelines<\/a><\/strong><\/li>\n\n\n\n<li><strong><a href=\"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/ci-cd-audit-red-flags-what-immediately-raises-auditor-concerns\/\" data-type=\"post\" data-id=\"264\">CI\/CD Audit Red Flags<\/a><\/strong><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n    <section class=\"rds-author-box rds-author-box--audit\"\r\n             dir=\"ltr\" lang=\"fr\"\r\n             style=\"border:1px solid rgba(100,116,139,.35);border-radius:14px;padding:16px 18px;margin:26px 0 18px;background:rgba(148,163,184,.08);\">\r\n      <strong style=\"margin:0 0 8px; font-size:14px; font-weight:700; letter-spacing:.02em;\">Contexte \u201caudit-ready\u201d<\/strong>\r\n      <p style=\"margin:0; font-size:14px; line-height:1.55;\">Contenu con\u00e7u pour les environnements r\u00e9glement\u00e9s : contr\u00f4les avant outils, enforcement par politiques dans le CI\/CD, et evidence-by-design pour l\u2019audit.<\/p>\r\n      <p style=\"margin:0; font-size:14px; line-height:1.55;\">Focus sur la tra\u00e7abilit\u00e9, les approbations, la gouvernance des exceptions et la r\u00e9tention des preuves de bout en bout.<\/p>\r\n      <p style=\"margin:0; font-size:14px; line-height:1.55;\">\r\n        <a href=\"https:\/\/regulated-devsecops.com\/fr\/fr\/about\/\">Voir la m\u00e9thodologie sur la page About.<\/a>\r\n      <\/p>\r\n    <\/section>\r\n    \n","protected":false},"excerpt":{"rendered":"<p>Les manquements au titre de DORA Article 28 proviennent rarement de politiques absentes. Ils proviennent de faiblesses cach\u00e9es dans les pipelines CI\/CD d\u00e9pendant de tiers qui ne se r\u00e9v\u00e8lent que lors d&rsquo;audits ou d&rsquo;incidents. Les auditeurs recherchent des signaux d&rsquo;alerte \u2014 des indices que le risque ICT li\u00e9 aux tiers est non g\u00e9r\u00e9, non appliqu\u00e9 &#8230; <a title=\"DORA Article 28 : Signaux d&rsquo;alerte \u2014 D\u00e9faillances courantes des risques tiers dans les pipelines CI\/CD\" class=\"read-more\" href=\"https:\/\/regulated-devsecops.com\/fr\/ci-cd-governance\/dora-article-28-red-flags-common-third-party-risk-failures-in-ci-cd\/\" aria-label=\"En savoir plus sur DORA Article 28 : Signaux d&rsquo;alerte \u2014 D\u00e9faillances courantes des risques tiers dans les pipelines CI\/CD\">Lire la suite<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[123,126],"tags":[],"post_folder":[],"class_list":["post-1222","post","type-post","status-publish","format-standard","hentry","category-ci-cd-governance","category-regulatory-frameworks"],"_links":{"self":[{"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/posts\/1222","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/comments?post=1222"}],"version-history":[{"count":0,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/posts\/1222\/revisions"}],"wp:attachment":[{"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/media?parent=1222"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/categories?post=1222"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/tags?post=1222"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/post_folder?post=1222"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}